secure-code-agent 0.3.0__tar.gz → 0.4.0__tar.gz

{secure_code_agent-0.3.0/src/secure_code_agent.egg-info → secure_code_agent-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.3.0
+Version: 0.4.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -32,6 +32,7 @@ Requires-Dist: PyYAML<7,>=6.0.2
 Provides-Extra: required-scanners
 Requires-Dist: bandit==1.9.4; extra == "required-scanners"
 Requires-Dist: pip-audit==2.10.1; extra == "required-scanners"
+Requires-Dist: njsscan==1.0.0; extra == "required-scanners"
 Provides-Extra: python-scanners
 Requires-Dist: secure-code-agent[required-scanners]; extra == "python-scanners"
 Requires-Dist: semgrep<2,>=1.172; extra == "python-scanners"
@@ -173,7 +174,9 @@ collapsed before scoring; reports preserve the original scanner evidence.
         ├── Hadolint          (Dockerfile lint)
         ├── OSV-Scanner       (multi-ecosystem SCA via osv.dev)
         ├── OpenSSF Scorecard (repo hygiene + supply chain)
-        ├── eslint-plugin-security  (JS/TS SAST)                     [v0.3]
+        ├── njsscan           (JS/TS SAST, offline, no Node needed)
+        ├── RuboCop           (Ruby security cops, --only Security)
+        ├── gosec             (Go SAST — opt-in; needs the Go toolchain)
         ├── CodeQL SARIF      (ingest GitHub-hosted analysis)
         └── Built-in regex rules (high-confidence, low-FP)
 ```
@@ -287,6 +290,10 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   reason:  "Slated for rewrite Q3 2026 — gated by initiative INV-44."
   expires: "2026-09-30"
 
+  fingerprint: 0aaa689f8a967d8c   # optional: pin to ONE finding (16 hex, from the report)
+
+  line: 18                          # optional: with fingerprint, pins the exact location
+
 - rule_id: "B101"
   paths:   ["tests/"]
   reason:  "assert statements are legitimate in test code."
@@ -390,6 +397,7 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 ## Documentation
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
+- [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.3.0 → secure_code_agent-0.4.0}/README.md

@@ -128,7 +128,9 @@ collapsed before scoring; reports preserve the original scanner evidence.
         ├── Hadolint          (Dockerfile lint)
         ├── OSV-Scanner       (multi-ecosystem SCA via osv.dev)
         ├── OpenSSF Scorecard (repo hygiene + supply chain)
-        ├── eslint-plugin-security  (JS/TS SAST)                     [v0.3]
+        ├── njsscan           (JS/TS SAST, offline, no Node needed)
+        ├── RuboCop           (Ruby security cops, --only Security)
+        ├── gosec             (Go SAST — opt-in; needs the Go toolchain)
         ├── CodeQL SARIF      (ingest GitHub-hosted analysis)
         └── Built-in regex rules (high-confidence, low-FP)
 ```
@@ -242,6 +244,10 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   reason:  "Slated for rewrite Q3 2026 — gated by initiative INV-44."
   expires: "2026-09-30"
 
+  fingerprint: 0aaa689f8a967d8c   # optional: pin to ONE finding (16 hex, from the report)
+
+  line: 18                          # optional: with fingerprint, pins the exact location
+
 - rule_id: "B101"
   paths:   ["tests/"]
   reason:  "assert statements are legitimate in test code."
@@ -345,6 +351,7 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 ## Documentation
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
+- [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.3.0 → secure_code_agent-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secure-code-agent"
-version = "0.3.0"
+version = "0.4.0"
 description = "Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -47,12 +47,18 @@ dependencies = [
 required-scanners = [
   "bandit==1.9.4",
   "pip-audit==2.10.1",
+  # njsscan is in the floor (D12) and is a Python package carrying its own
+  # rules, so a JavaScript repository can be scanned on a host with no Node.
+  # Pinned for the same reason as the rest: the floor is a claim about what
+  # ran, and an unpinned ruleset makes that claim unreproducible.
+  "njsscan==1.0.0",
 ]
 # The remaining Python-packaged scanners. Bounded rather than pinned because
 # they are optional; the coverage gate does not require them by default.
-# Scanners distributed as standalone binaries (gitleaks, hadolint, npm,
-# osv-scanner, scorecard, trivy, trufflehog) cannot be installed from PyPI —
-# see docs/scanners.md for their install commands and the SARIF-import route.
+# Scanners distributed as standalone binaries or through another language's
+# package manager (gitleaks, gosec, hadolint, npm, osv-scanner, rubocop,
+# scorecard, trivy, trufflehog) cannot be installed from PyPI — see
+# docs/scanners.md for their install commands and the SARIF-import route.
 python-scanners = [
   "secure-code-agent[required-scanners]",
   "semgrep>=1.172,<2",
@@ -92,7 +98,12 @@ target-version = "py310"
 # Ruff 0.16 formats Python blocks embedded in Markdown. Our docs use those
 # blocks illustratively — excerpted statements, aligned-comment schemas — and
 # reformatting them damages the documentation without improving any code.
-extend-exclude = ["**/*.md"]
+extend-exclude = [
+  "**/*.md",
+  # Scanner fixtures are deliberately vulnerable sample code. Linting them
+  # would demand we fix the very patterns the rules exist to detect.
+  "tests/fixtures/**",
+]
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "B", "UP", "SIM", "C4"]

{secure_code_agent-0.3.0 → secure_code_agent-0.4.0/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.3.0
+Version: 0.4.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -32,6 +32,7 @@ Requires-Dist: PyYAML<7,>=6.0.2
 Provides-Extra: required-scanners
 Requires-Dist: bandit==1.9.4; extra == "required-scanners"
 Requires-Dist: pip-audit==2.10.1; extra == "required-scanners"
+Requires-Dist: njsscan==1.0.0; extra == "required-scanners"
 Provides-Extra: python-scanners
 Requires-Dist: secure-code-agent[required-scanners]; extra == "python-scanners"
 Requires-Dist: semgrep<2,>=1.172; extra == "python-scanners"
@@ -173,7 +174,9 @@ collapsed before scoring; reports preserve the original scanner evidence.
         ├── Hadolint          (Dockerfile lint)
         ├── OSV-Scanner       (multi-ecosystem SCA via osv.dev)
         ├── OpenSSF Scorecard (repo hygiene + supply chain)
-        ├── eslint-plugin-security  (JS/TS SAST)                     [v0.3]
+        ├── njsscan           (JS/TS SAST, offline, no Node needed)
+        ├── RuboCop           (Ruby security cops, --only Security)
+        ├── gosec             (Go SAST — opt-in; needs the Go toolchain)
         ├── CodeQL SARIF      (ingest GitHub-hosted analysis)
         └── Built-in regex rules (high-confidence, low-FP)
 ```
@@ -287,6 +290,10 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   reason:  "Slated for rewrite Q3 2026 — gated by initiative INV-44."
   expires: "2026-09-30"
 
+  fingerprint: 0aaa689f8a967d8c   # optional: pin to ONE finding (16 hex, from the report)
+
+  line: 18                          # optional: with fingerprint, pins the exact location
+
 - rule_id: "B101"
   paths:   ["tests/"]
   reason:  "assert statements are legitimate in test code."
@@ -390,6 +397,7 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 ## Documentation
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
+- [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.3.0 → secure_code_agent-0.4.0}/src/secure_code_agent.egg-info/SOURCES.txt

@@ -16,21 +16,27 @@ src/secure_code_audit/git_tools.py
 src/secure_code_audit/instructions.py
 src/secure_code_audit/remediation.py
 src/secure_code_audit/renderers.py
+src/secure_code_audit/ruleset.py
 src/secure_code_audit/sarif.py
 src/secure_code_audit/scanner_status.py
 src/secure_code_audit/scoring.py
 src/secure_code_audit/standards.py
 src/secure_code_audit/suppressions.py
+src/secure_code_audit/data/semgrep-offline.yaml
 src/secure_code_audit/scanners/__init__.py
 src/secure_code_audit/scanners/bandit_scanner.py
 src/secure_code_audit/scanners/base.py
 src/secure_code_audit/scanners/builtin_rules.py
 src/secure_code_audit/scanners/checkov_scanner.py
+src/secure_code_audit/scanners/floor.py
 src/secure_code_audit/scanners/gitleaks_scanner.py
+src/secure_code_audit/scanners/gosec_scanner.py
 src/secure_code_audit/scanners/hadolint_scanner.py
+src/secure_code_audit/scanners/njsscan_scanner.py
 src/secure_code_audit/scanners/npm_audit_scanner.py
 src/secure_code_audit/scanners/osv_scanner.py
 src/secure_code_audit/scanners/pip_audit_scanner.py
+src/secure_code_audit/scanners/rubocop_scanner.py
 src/secure_code_audit/scanners/scorecard_scanner.py
 src/secure_code_audit/scanners/semgrep_scanner.py
 src/secure_code_audit/scanners/trivy_scanner.py

{secure_code_agent-0.3.0 → secure_code_agent-0.4.0}/src/secure_code_agent.egg-info/requires.txt

@@ -14,3 +14,4 @@ checkov<4,>=3.3
 [required-scanners]
 bandit==1.9.4
 pip-audit==2.10.1
+njsscan==1.0.0

{secure_code_agent-0.3.0 → secure_code_agent-0.4.0}/src/secure_code_audit/cli.py

@@ -25,15 +25,17 @@ from secure_code_audit import (
 from secure_code_audit import baseline as baseline_mod
 from secure_code_audit import config as config_mod
 from secure_code_audit.findings import Category, Finding, Severity
-from secure_code_audit.git_tools import find_repo_root, loc_under
+from secure_code_audit.git_tools import find_repo_root, is_excluded, loc_under
 from secure_code_audit.scanner_status import (
     ScannerExecution,
     ScannerOutcome,
-    classify_execution,
     evaluate_coverage,
+    execution_from_result,
 )
-from secure_code_audit.scoring import evaluate_gates
+from secure_code_audit.scanners import floor
+from secure_code_audit.scoring import active_gates, evaluate_gates
 from secure_code_audit.scoring import score as score_findings
+from secure_code_audit.scoring import verdict as build_verdict
 
 
 def _parser() -> argparse.ArgumentParser:
@@ -90,6 +92,16 @@ def _parser() -> argparse.ArgumentParser:
         ),
     )
 
+    p.add_argument(
+        "--trust-target-config",
+        action="store_true",
+        help=(
+            "Allow a config inside the audited tree to name executables from "
+            "that tree. Only for repositories you own. CLI-only by design: a "
+            "config file cannot grant itself this."
+        ),
+    )
+
     p.add_argument(
         "--preflight",
         action="store_true",
@@ -156,7 +168,12 @@ def _do_preflight(args: argparse.Namespace) -> int:
     cached from this command.
     """
     cfg, target, _ = _prepare_audit(args)
-    required = set(cfg.gates.get("require_scanners", []))
+    inventory = _repository_inventory(target, cfg)
+    required = {
+        name
+        for name in floor.expand_required(cfg.gates.get("require_scanners", []))
+        if floor.applies_to_repository(name, *inventory)
+    }
     selected = _selected_scanners(args, cfg)
 
     rows: list[dict] = []
@@ -209,6 +226,10 @@ def _print_preflight(rows: list[dict], unselected: list[str], blocking: list[str
             print(f"      → {row['remedy']}")
     for name in unselected:
         print(f"  ✗ {name:<14} required  not enabled in this configuration")
+    # Named, not omitted: a floor tool this run does not evaluate is a stated
+    # scope decision, and silence would read as a pass.
+    for name in floor.REPOSITORY_CADENCE_NAMES:
+        print(f"  · {name:<14} deferred  repository cadence; supplied by SARIF import (D3)")
     if blocking:
         print(f"  required scanners unavailable: {', '.join(blocking)}")
     else:
@@ -217,6 +238,7 @@ def _print_preflight(rows: list[dict], unselected: list[str], blocking: list[str
 
 def _do_audit(args: argparse.Namespace) -> int:
     cfg, target, root = _prepare_audit(args)
+    _require_configured_gates(args, cfg)
 
     # ----- scanners -----
     scan = _run_scanners(args, cfg, target)
@@ -229,6 +251,9 @@ def _do_audit(args: argparse.Namespace) -> int:
     all_findings.extend(imported)
     executions.extend(imported_executions)
 
+    # ----- scan scope, enforced once -----
+    all_findings = _drop_excluded(all_findings, target, cfg)
+
     # ----- overrides from config -----
     all_findings = _apply_overrides(all_findings, cfg)
 
@@ -272,27 +297,37 @@ def _do_audit(args: argparse.Namespace) -> int:
     score = score_findings(all_findings, loc)
     # Naming an import on the command line asserts that it contributes coverage,
     # so a broken one fails the gate even if no config requires that scanner.
+    # Requiring a tool that has nothing to look at would make every
+    # single-language repository permanently incomplete, and an alarm that is
+    # always on is not an alarm. Applicability is decided from what the tree
+    # actually contains, before the requirement is asserted.
+    inventory = _repository_inventory(target, cfg)
     required = [
-        *cfg.gates.get("require_scanners", []),
+        *(
+            name
+            for name in floor.expand_required(cfg.gates.get("require_scanners", []))
+            if floor.applies_to_repository(name, *inventory)
+        ),
         *(execution.name for execution in imported_executions),
     ]
     coverage = evaluate_coverage(executions, required)
     gate = evaluate_gates(all_findings, score, cfg.gates, coverage)
+    verdict = build_verdict(score, cfg.gates, coverage)
 
     # ----- write outputs -----
     paths = _resolve_outputs(args, cfg, root)
-    _write_outputs(paths, all_findings, score, gate, coverage, ran, unavailable)
+    _write_outputs(paths, all_findings, score, gate, coverage, ran, unavailable, verdict)
     if args.bump_baseline:
         baseline_mod.write(baseline_path, all_findings, baseline)
 
     # ----- terminal output -----
     if args.json:
         sys.stdout.write(
-            json.dumps(renderers.to_json(all_findings, score, gate, coverage), indent=2)
+            json.dumps(renderers.to_json(all_findings, score, gate, coverage, verdict), indent=2)
         )
         sys.stdout.write("\n")
     else:
-        _print_summary(score, gate, ran, unavailable, coverage, paths)
+        _print_summary(verdict, score, gate, ran, unavailable, coverage, paths)
 
     return _exit_code(args, gate, all_findings)
 
@@ -301,18 +336,42 @@ def _prepare_audit(
     args: argparse.Namespace,
 ) -> tuple[config_mod.Config, Path, Path]:
     """Load config and resolve the single scan root, or refuse."""
-    cfg = config_mod.load(args.config)
-    _validate_scanner_config(cfg)
     if args.changed_only:
         raise ValueError(
             "--changed-only is not implemented safely; refusing to claim a scoped audit"
         )
     if len(args.paths) > 1:
         raise ValueError("multiple scan roots are not supported; provide one repository root")
+    # The target is resolved first because the default config belongs to it.
     target = Path(args.paths[0]).resolve()
+    cfg = config_mod.load(args.config, default_root=target)
+    # Set from the command line only. Threading it through the loaded config
+    # would let a repository-supplied file assert its own trustworthiness.
+    cfg.trust_target_config = bool(getattr(args, "trust_target_config", False))
+    _validate_scanner_config(cfg)
     return cfg, target, find_repo_root(target)
 
 
+def _require_configured_gates(args: argparse.Namespace, cfg: config_mod.Config) -> None:
+    """Refuse --fail-on-gate when no gate could ever fail.
+
+    Without this, an audit that detects a HIGH finding, scores it 0.00/F, and
+    reports it in full still exits 0, because every gate is absent and an
+    absent gate does not trip. That is a green build with no security floor,
+    and it is the shape a default Action adoption takes.
+    """
+    if not args.fail_on_gate or active_gates(cfg.gates):
+        return
+    raise ValueError(
+        "--fail-on-gate was requested but no gate is configured, so no finding "
+        "could ever fail the build. Configure at least one of "
+        "gates.fail_on_severity, gates.fail_on_category, gates.fail_on_new, "
+        "gates.min_score (above 0), gates.require_scanners, or "
+        "gates.max_unsuppressed — see secure-code-agent.example.json. Drop "
+        "--fail-on-gate to run an ungated, report-only audit."
+    )
+
+
 def _exit_code(args: argparse.Namespace, gate, findings: list[Finding]) -> int:
     if args.fail_on_gate and not gate.passed:
         return 1
@@ -336,6 +395,38 @@ class _ScanResult:
     executions: list[ScannerExecution]
 
 
+def _repository_inventory(target: Path, cfg: config_mod.Config) -> tuple[set[str], set[str]]:
+    """Extensions and notable filenames present in the tree, for applicability.
+
+    Bounded by the same exclusions the scan uses, so a vendored manifest does
+    not make a whole ecosystem look present.
+    """
+    from secure_code_audit.git_tools import is_excluded
+
+    extensions: set[str] = set()
+    filenames: set[str] = set()
+    for path in target.rglob("*"):
+        if not path.is_file() or is_excluded(path, target, cfg.exclude_patterns):
+            continue
+        extensions.add(path.suffix)
+        filenames.add(path.name)
+    return extensions, filenames
+
+
+def _scanner_enabled(cfg: config_mod.Config, name: str) -> bool:
+    """Whether this scanner runs, with the floor supplying the default.
+
+    A configuration that says nothing about a scanner gets the project's
+    declared opinion: floor tools run, opt-in tools do not. Previously every
+    registered scanner defaulted to enabled, which quietly turned overlapping
+    and copyleft tools on for operators who never chose them.
+    """
+    configured = cfg.scanners.get(name)
+    # `cfg.scanners` only holds scanners the configuration actually named, so
+    # presence here is the operator having an opinion.
+    return configured.enabled if configured is not None else floor.default_enabled(name)
+
+
 def _selected_scanners(args: argparse.Namespace, cfg: config_mod.Config) -> list[str]:
     """Names the operator actually asked for, in registry order."""
     skip = set(filter(None, (args.skip_scanners or "").split(",")))
@@ -343,30 +434,63 @@ def _selected_scanners(args: argparse.Namespace, cfg: config_mod.Config) -> list
     return [
         name
         for name in scanners.SCANNERS
-        if not (only and name not in only)
-        and name not in skip
-        and (cfg.scanners.get(name) or config_mod.ScannerConfig()).enabled
+        if not (only and name not in only) and name not in skip and _scanner_enabled(cfg, name)
     ]
 
 
+def _drop_excluded(findings: list[Finding], target: Path, cfg: config_mod.Config) -> list[Finding]:
+    """Enforce `paths.exclude_patterns` on findings, not just on file discovery.
+
+    Five of fifteen adapters push the exclusion down to their tool; the rest
+    have no flag for it, or read it from a config file in the audited tree that
+    D1 forbids us honouring. So the setting was true for Bandit and a polite
+    fiction for Checkov, RuboCop, Trivy, Semgrep and the others.
+
+    That is worse than cosmetic, because `exclude_patterns` is *also* the
+    denominator: `loc_under()` counts only non-excluded files while the
+    findings counted against them came from everywhere. A repository excluding
+    its vendored tree was scored on vendored findings over first-party lines —
+    the numerator and denominator measuring different repositories.
+
+    Pushing the exclusion into each adapter is still worth doing for speed and
+    for smaller tool output. Correctness is enforced here, once, where every
+    finding passes regardless of which adapter or SARIF import produced it.
+
+    Control findings are exempt: they carry the scan root as their path, and
+    dropping "bandit could not run" because the root matched a pattern would
+    turn a failed scanner back into a silent one — the defect this whole
+    project exists to prevent.
+    """
+    if not cfg.exclude_patterns:
+        return findings
+
+    root = target if target.is_dir() else target.parent
+    kept: list[Finding] = []
+    for finding in findings:
+        path = finding.file_path
+        is_control = path in (target, root)
+        if not is_control and is_excluded(path, root, cfg.exclude_patterns):
+            continue
+        kept.append(finding)
+    return kept
+
+
 def _run_scanners(args: argparse.Namespace, cfg: config_mod.Config, target: Path) -> _ScanResult:
     result = _ScanResult(findings=[], ran=[], unavailable=[], executions=[])
     for name in _selected_scanners(args, cfg):
-        sc_cfg = cfg.scanners.get(name) or config_mod.ScannerConfig()
         scanner = scanners.SCANNERS[name]()
         scanner.configure(target, cfg)
         available = scanner.is_available()
         if not available:
             result.unavailable.append(name)
         version = scanner.binary_version() if available else None
-        findings = scanner.run(target, cfg)
-        result.findings.extend(findings)
-        execution = classify_execution(
+        scan = scanner.scan(target, cfg)
+        result.findings.extend(scan.findings)
+        execution = execution_from_result(
             name,
-            findings,
+            scan,
             command=scanner.command if available else (),
             version=version,
-            scope=_scanner_scope(name, sc_cfg),
         )
         result.executions.append(execution)
         if execution.outcome is ScannerOutcome.COMPLETED:
@@ -399,15 +523,17 @@ def _ingest_sarif_imports(specs: list[str]) -> tuple[list[Finding], list[Scanner
     return findings, executions
 
 
-def _write_outputs(paths, findings, score, gate, coverage, ran, unavailable) -> None:
+def _write_outputs(paths, findings, score, gate, coverage, ran, unavailable, verdict) -> None:
     if paths.markdown is not None:
-        renderers.write_markdown(findings, score, gate, paths.markdown, ran, unavailable, coverage)
+        renderers.write_markdown(
+            findings, score, gate, paths.markdown, ran, unavailable, coverage, verdict
+        )
     if paths.json_out is not None:
-        renderers.write_json(findings, score, gate, paths.json_out, coverage)
+        renderers.write_json(findings, score, gate, paths.json_out, coverage, verdict)
     if paths.sarif is not None:
         sarif.write(findings, paths.sarif, coverage)
     if paths.comment is not None:
-        renderers.write_pr_comment(findings, score, gate, paths.comment, coverage)
+        renderers.write_pr_comment(findings, score, gate, paths.comment, coverage, verdict)
     if paths.prompt is not None:
         remediation.write(findings, paths.prompt)
 
@@ -462,18 +588,19 @@ def _under_root(root: Path, value: str) -> Path:
     return path.resolve() if path.is_absolute() else (root / path).resolve()
 
 
-def _print_summary(score, gate, ran, unavailable, coverage, paths) -> None:
+def _print_summary(verdict, score, gate, ran, unavailable, coverage, paths) -> None:
     status = "PASS" if gate.passed else "FAIL"
-    score_label = "score"
-    if coverage.status.value != "complete":
-        score_label = "finding score (coverage incomplete)"
-    print(
-        f"secure-code-agent  ·  {score_label} {score.overall:.2f} ({score.letter})  "
-        f"·  gate {status}"
-    )
+    print(f"secure-code-agent  ·  score {verdict.headline()}  ·  gate {status}")
+    for reason in verdict.reasons:
+        print(f"  ! grade withheld: {reason}")
     print(f"  scanned LOC: {score.loc_scanned:,}")
     print(f"  scanners run: {', '.join(ran) if ran else '(none)'}")
-    print(f"  coverage: {coverage.status.value.upper()}")
+    coverage_line = f"  coverage: {coverage.status.value.upper()}"
+    if coverage.unverified:
+        coverage_line += (
+            f"  ({len(coverage.unverified)} unverified: {', '.join(coverage.unverified)})"
+        )
+    print(coverage_line)
     if unavailable:
         print(f"  unavailable: {', '.join(unavailable)}")
     if not gate.passed:
@@ -493,23 +620,13 @@ def _validate_scanner_config(cfg: config_mod.Config) -> None:
     unknown = sorted(set(cfg.scanners) - known)
     if unknown:
         raise ValueError(f"unknown scanner configuration: {', '.join(unknown)}")
-    required = set(cfg.gates.get("require_scanners", []))
+    # Expand the `floor` token before validating, so requiring the declared
+    # minimum does not read as a typo'd scanner name.
+    required = set(floor.expand_required(cfg.gates.get("require_scanners", [])))
     unknown_required = sorted(required - known)
     if unknown_required:
         raise ValueError(f"unknown required scanner: {', '.join(unknown_required)}")
 
 
-def _scanner_scope(name: str, cfg: config_mod.ScannerConfig) -> str | None:
-    """Describe configured audit scope without changing scanner semantics."""
-    if name != "pip_audit":
-        return None
-    parts = [f"mode={cfg.mode}"]
-    if cfg.inputs:
-        parts.append(f"inputs={','.join(cfg.inputs)}")
-    if cfg.extra_args:
-        parts.append(f"extra_args={' '.join(cfg.extra_args)}")
-    return "; ".join(parts)
-
-
 if __name__ == "__main__":
     sys.exit(main())